Age Verification: Region-Based Access Gating
XYZ Protect includes built-in adult verification for sites that serve age-restricted content. The current implementation is a privacy-first means of determining whether a visitor is 18+ (adult or not adult). Visitors from regulated regions are redirected to a privacy-first identity verification page before they can view content.
Note: The current age verification system is designed for adult verification only — it answers the question "Is this person 18 or older?" It is not currently designed for segregating users into specific age groups. A future version may integrate with age verification systems (such as AgeKey/OpenAge) suitable for threshold-based age group verification (13+, 16+, 18+, 21+).
This guide covers setup, region rules, and testing.
When You Need Age Verification
Age verification is required in jurisdictions that mandate identity verification for age-restricted content, including:
- United States (multiple state laws — Virginia, Texas, Louisiana, and more)
- United Kingdom (OFCOM regulations)
- European Union (varying by member state)
- Australia, Canada, and others with emerging regulations
If your site serves adult content, cannabis education, alcohol-related content, or gambling-related content, age verification may be legally required in some or all of the jurisdictions where your visitors are located.
Requirements
- XYZ Protect installed and connected
- Your site must be behind Cloudflare's proxy (orange cloud) for automatic region detection
- Cloudflare Transform Rules configured to add regional headers (CF-IPCountry and CF-Region-Code)
Note: Age verification requires Cloudflare on your main domain for geographic detection. Content protection (without age verification) does not require Cloudflare — only the media subdomain CNAME.
Setup
- Go to Settings > XYZ Protect > Age Verification
- Enable age verification
- Choose the scope: entire site or specific paths
- Click Fetch from API to retrieve your cookie signing key
- Save settings — the plugin creates an age gate page automatically
Region Rules
Add rules for specific countries and states. Each rule specifies:
- Region — A country (e.g., US, GB, AU) or a country + state (e.g., US-TX, US-VA)
- Action — Verify (require age verification), Allow (no verification needed), or Block (deny access entirely)
- Minimum Age — The required age threshold (18 by default; non-18 thresholds like 21 require Tier 2 verification)
- Tier — Tier 1 (face-based age estimation) or Tier 2 (government ID verification with face matching)
Example rules:
- US-TX → Verify, Age 18, Tier 2
- US-VA → Verify, Age 18, Tier 2
- GB → Verify, Age 18, Tier 1
- US → Allow (default for states without mandates)
- Default → Allow
Rules are evaluated from most specific to least specific. A rule for US-TX takes priority over a general US rule.
Verification Tiers
Tier 1 — Face-Based Estimation: Uses biometric facial analysis to estimate whether the visitor is likely an adult. Privacy-first — the image is processed in memory only and never stored. Fastest and least intrusive verification method.
Tier 2 — Government ID Verification: Requires the visitor to present a government-issued photo ID. The system extracts only the date of birth and document expiration date, then verifies the photo matches the person. The ID image is never stored.
Verification Credits
Age verification uses a prepaid credit system. Credits are consumed per verification attempt, whether successful or not.
Credit consumption:
- Tier 1 verification = 1 credit
- Tier 2 verification = 3 credits (Tier 2 runs in addition to Tier 1, consuming 1 + 2 = 3 credits total)
Credit packs are available in various sizes, with larger packs offering better per-credit pricing. Purchase credit packs through your xyzinc.com account.
| Pack Size | Price | Per-Credit Cost |
|-----------|-------|----------------|
| 250 credits | $15.00 | $0.060 |
| 500 credits | $27.50 | $0.055 |
| 1,000 credits | $45.00 | $0.045 |
| 2,500 credits | $100.00 | $0.040 |
| 5,000 credits | $187.50 | $0.038 |
Test Mode
Test mode lets you simulate verification from any region without needing actual traffic from that region. When enabled, append ?reg=US-TX (or any region code) to any page URL to test that region's rules.
Test mode is visible only to site administrators and does not affect regular visitors.
How Age Verification and Content Protection Work Together
Age verification and content protection are independent but complementary:
- Age verification gates the page — unverified visitors from regulated regions cannot see the page at all
- Content protection gates the media — even if someone bypasses the page gate or extracts a media URL, they can't access the file without proper authorization
For visitors from regions that don't require age verification, content protection cookies are issued transparently on first page load. They never see a verification screen, but their media access is still protected.
